This section presents a method for learning EBMs that are capable of preserving the appearance of an in-distribution initial state across several thousand MCMC steps. Such models are useful for the purpose of adversarial defense. Our defense framework is based on the approach in [1]}, which uses an EBM to defend an independent naturally trained classifier. Appendix REF  briefly reviews the EBM defense and compares this approach with other defense methods. We then present our proposed method for learning a defensive EBM (REF ), which is based on persistent initialization using a fixed pretrained generator as a source of rejuvenation. Finally, we apply our defense to achieve state-of-the-art performance for purification-based defense on CIFAR-10 and ImageNet.
<FIGURE>